@payez/next-mvp 4.13.1 → 4.15.0

package/dist/lib/credential-sign-in-client.d.ts

@@ -25,6 +25,10 @@ export type CredentialSignInResult = {
     codeRequest: CodeRequest;
     devCode: string | null;
     nextStep: NextStep;
+}
+/** AUTH-045: the code was accepted as contact proof and the IdP says this user must ENROL a factor on this client. Its own state, so it can never be drawn as the code box. */
+ | {
+    kind: 'enrol_required';
 } | {
     kind: 'rate_limited';
     message: string;

package/dist/lib/credential-sign-in-client.js

@@ -80,8 +80,20 @@ async function credentialSignIn(args, fetchImpl = (input, init) => fetch(input,
             const code = body?.code === 'second_factor_rate_limited' ? 'second_factor_rate_limited' : 'too_many_attempts';
             return { kind: 'rate_limited', message: (0, sign_in_failure_1.tooManyAttemptsMessage)(body?.retryAfter, code), code };
         }
-        if (body?.requiresTwoFactor)
+        if (body?.requiresTwoFactor) {
+            // AUTH-045 (BAPert 100969 rows 1-2): requiresTwoFactor alone cannot mean "go enrol" (it is also the password turn's "a code was sent"); the walk of
+            // 14 Nov showed the form redrawing the code box forever. The door's enrolmentRequired flag is the only signal for enrolment, and anything the
+            // client does not understand is a VISIBLE error, never a redraw.
+            const raw = body?.nextStep;
+            const unexpected = { kind: 'error', message: exports.MSG_UNEXPECTED, code: 'sign_in_failed', offerEmailCode: false };
+            if (body?.enrolmentRequired === true)
+                return raw === 'enroll_mfa' ? { kind: 'enrol_required' } : unexpected;
+            if (raw !== undefined && raw !== null && raw !== 'enroll_mfa' && raw !== 'mfa_verify')
+                return unexpected;
+            if (args.code && raw === 'enroll_mfa')
+                return unexpected; // a CODE turn told "enrol" without the flag is an older door: never a redraw
             return { kind: 'two_factor', codeRequest: (0, code_step_copy_1.readCodeRequest)(body), devCode: readDevCode(body), nextStep: readNextStep(body) };
+        }
         if (!res.ok || body?.success !== true) {
             const offerEmailCode = body?.offerEmailCode === true;
             if ((0, sign_in_failure_1.isSignInFailureCode)(body?.code))

package/dist/lib/first-enrol.d.ts

@@ -0,0 +1,66 @@
+/**
+ * AUTH-045 first-enrolment carry (PAY-2938, BAPert 100969): the server logic of the two enrolment calls a generated app makes for a user the IdP told
+ * to ENROL a factor on this client. Ported from VibeID-Customer-Portal PAY-2798 part 2 (src/lib/auth/enrol-core.ts + enrol-required.ts at a9ab685c);
+ * the pattern is not redesigned.
+ *
+ * WHY IT EXISTS. The credential door (api-handlers/auth/credential-login) answers an enrolment-scoped token (access, NO refresh) with the enrolment
+ * answer and mints NO session, so the package's session-gated MFA routes cannot serve this user. The door parks that token in an httpOnly cookie
+ * (ENROL_COOKIE); the two routes built on this module read ONLY that cookie, and ONLY for these two operations. No other route reads it.
+ *
+ * Rules held here (each has a row in test/first-enrol-core.test.cjs): the scoped token and the full pair a confirm answers NEVER appear in a returned
+ * body; the IdP's prose is never relayed; nothing is logged; the confirm body is a whitelist; the recovery codes are fetched with the confirm's full
+ * pair SERVER-SIDE ONLY and that pair is then dropped (this module mints no session: what follows is the sign-in the person already knows).
+ *
+ * No framework imports: a test runs it with a stubbed fetch.
+ */
+export declare const ENROL_COOKIE = "payez_enrol";
+export declare const ENROL_COOKIE_MAX_AGE = 600;
+export type EnrolStep = 'enroll' | 'confirm';
+export declare const ENROL_STEPS: readonly EnrolStep[];
+export type Fetcher = (url: string, init: RequestInit & {
+    headers: Record<string, string>;
+}) => Promise<Response>;
+export type CoreDeps = {
+    fetchImpl: Fetcher;
+    idp: string;
+    clientKey: string;
+};
+/** `cookie`: what the route does with the enrolment cookie. */
+export type CoreResult = {
+    status: number;
+    body: Record<string, unknown>;
+    cookie: 'clear' | 'keep';
+};
+export declare function enrolIdpPath(step: EnrolStep): string;
+/** The body each step may carry: enroll { friendly_name? }, confirm { enrollment_id, code }. null = nothing is sent. */
+export declare function enrolBodyFor(step: EnrolStep, raw: unknown): Record<string, unknown> | null;
+export declare function parseEnrol(body: unknown): {
+    secret: string;
+    otpauthUri: string;
+    enrollmentId: number;
+} | null;
+export declare function parseConfirmed(body: unknown): boolean;
+export declare function parseCodes(body: unknown): string[] | null;
+export declare function codesForDisplay(codes: readonly string[]): string[];
+/** What a person reads for a failed enrol / confirm call (never the server's text). 'sign-in' = 401/403: the page goes to sign-in, never a message box. */
+export declare function enrolRefusal(step: EnrolStep, status: number, body: unknown): {
+    status: number;
+    code: string;
+    text: string;
+} | 'sign-in';
+export declare function runEnrolStep(deps: CoreDeps, input: {
+    step: EnrolStep;
+    token: string;
+    body: unknown;
+}): Promise<CoreResult>;
+export declare const LIMIT_PER_COOKIE = 5;
+/**
+ * HARD CAP (portal PAY-2913, BAPert 90048): the map never holds more than this many keys; past it the OLDEST-TOUCHED key is evicted.
+ * KNOWN TRADE: a flood of forged cookies can push a real caller's counter out and reset its budget; bounded by this cap and by the IdP's own throttle.
+ * Not ported from the portal: the per-IP limit (it needs the trusted-proxy setting, PORTAL_TRUSTED_PROXY_HOPS, which a generated app does not have).
+ */
+export declare const MAX_TRACKED_KEYS = 5000;
+/** True when this key may attempt now; records the attempt. Keys are never the raw cookie (the route passes a digest). */
+export declare function attemptAllowed(key: string, limit: number, now?: number): boolean;
+export declare function _resetAttempts(): void;
+export declare function _trackedKeys(): number;

package/dist/lib/first-enrol.js

@@ -0,0 +1,188 @@
+"use strict";
+/**
+ * AUTH-045 first-enrolment carry (PAY-2938, BAPert 100969): the server logic of the two enrolment calls a generated app makes for a user the IdP told
+ * to ENROL a factor on this client. Ported from VibeID-Customer-Portal PAY-2798 part 2 (src/lib/auth/enrol-core.ts + enrol-required.ts at a9ab685c);
+ * the pattern is not redesigned.
+ *
+ * WHY IT EXISTS. The credential door (api-handlers/auth/credential-login) answers an enrolment-scoped token (access, NO refresh) with the enrolment
+ * answer and mints NO session, so the package's session-gated MFA routes cannot serve this user. The door parks that token in an httpOnly cookie
+ * (ENROL_COOKIE); the two routes built on this module read ONLY that cookie, and ONLY for these two operations. No other route reads it.
+ *
+ * Rules held here (each has a row in test/first-enrol-core.test.cjs): the scoped token and the full pair a confirm answers NEVER appear in a returned
+ * body; the IdP's prose is never relayed; nothing is logged; the confirm body is a whitelist; the recovery codes are fetched with the confirm's full
+ * pair SERVER-SIDE ONLY and that pair is then dropped (this module mints no session: what follows is the sign-in the person already knows).
+ *
+ * No framework imports: a test runs it with a stubbed fetch.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_TRACKED_KEYS = exports.LIMIT_PER_COOKIE = exports.ENROL_STEPS = exports.ENROL_COOKIE_MAX_AGE = exports.ENROL_COOKIE = void 0;
+exports.enrolIdpPath = enrolIdpPath;
+exports.enrolBodyFor = enrolBodyFor;
+exports.parseEnrol = parseEnrol;
+exports.parseConfirmed = parseConfirmed;
+exports.parseCodes = parseCodes;
+exports.codesForDisplay = codesForDisplay;
+exports.enrolRefusal = enrolRefusal;
+exports.runEnrolStep = runEnrolStep;
+exports.attemptAllowed = attemptAllowed;
+exports._resetAttempts = _resetAttempts;
+exports._trackedKeys = _trackedKeys;
+exports.ENROL_COOKIE = 'payez_enrol';
+exports.ENROL_COOKIE_MAX_AGE = 600;
+exports.ENROL_STEPS = ['enroll', 'confirm'];
+const SENTENCE_UNAVAILABLE = 'We could not reach the sign-in service. Nothing was changed. Try again in a moment.';
+function enrolIdpPath(step) {
+    return step === 'enroll' ? '/api/Account/mfa/totp/enroll' : '/api/Account/mfa/totp/confirm';
+}
+/** The body each step may carry: enroll { friendly_name? }, confirm { enrollment_id, code }. null = nothing is sent. */
+function enrolBodyFor(step, raw) {
+    const src = raw && typeof raw === 'object' && !Array.isArray(raw) ? raw : {};
+    if (step === 'enroll') {
+        const n = src.friendly_name;
+        return typeof n === 'string' && n.trim() !== '' && n.length <= 64 ? { friendly_name: n.trim() } : {};
+    }
+    const id = src.enrollment_id;
+    const code = src.code;
+    if (typeof id !== 'number' || !Number.isInteger(id) || id <= 0)
+        return null;
+    if (typeof code !== 'string' || !/^\d{6}$/.test(code))
+        return null;
+    return { enrollment_id: id, code };
+}
+const unwrap = (b) => {
+    if (!b || typeof b !== 'object' || Array.isArray(b))
+        return null;
+    const o = b;
+    return o.data && typeof o.data === 'object' && !Array.isArray(o.data) ? o.data : o;
+};
+const str = (v) => (typeof v === 'string' && v !== '' ? v : null);
+function parseEnrol(body) {
+    const d = unwrap(body);
+    const secret = str(d?.secret);
+    const uri = str(d?.otpauth_uri);
+    const id = d?.enrollment_id;
+    if (!d || !secret || !uri || !uri.startsWith('otpauth://totp/') || typeof id !== 'number' || !Number.isInteger(id))
+        return null;
+    return { secret, otpauthUri: uri, enrollmentId: id };
+}
+function parseConfirmed(body) {
+    return unwrap(body)?.confirmed === true;
+}
+function parseCodes(body) {
+    const d = unwrap(body);
+    const codes = d?.codes;
+    if (!Array.isArray(codes) || codes.length === 0 || !codes.every((c) => typeof c === 'string' && c !== ''))
+        return null;
+    return codes;
+}
+function codesForDisplay(codes) {
+    return codes.map((c) => c.trim()).filter((c) => c !== '');
+}
+/** What a person reads for a failed enrol / confirm call (never the server's text). 'sign-in' = 401/403: the page goes to sign-in, never a message box. */
+function enrolRefusal(step, status, body) {
+    if (status === 401 || status === 403)
+        return 'sign-in';
+    const c = (() => {
+        const b = body;
+        if (b && typeof b.code === 'string')
+            return b.code;
+        if (b && typeof b.error === 'object' && b.error && typeof b.error.code === 'string')
+            return b.error.code;
+        return null;
+    })();
+    if (status === 429)
+        return { status: 429, code: 'TOO_MANY', text: 'Too many attempts. Wait a few minutes and try again.' };
+    if (step === 'confirm' && status >= 400 && status < 500) {
+        if (c === 'enrollment_not_found')
+            return { status: 400, code: 'ENROLMENT_RESTART', text: 'This setup timed out. Reload the page to get a new code to scan.' };
+        return { status: 400, code: 'CODE_INVALID', text: 'That code did not work. Check the 6 digits in your authenticator app and try again.' };
+    }
+    return { status: 502, code: 'UNAVAILABLE', text: SENTENCE_UNAVAILABLE };
+}
+const headers = (token, clientKey) => ({
+    'Content-Type': 'application/json',
+    Accept: 'application/json',
+    Authorization: `Bearer ${token}`,
+    'X-Client-Id': clientKey,
+});
+const asJson = async (res) => res.json().catch(() => null);
+async function runEnrolStep(deps, input) {
+    const body = enrolBodyFor(input.step, input.body);
+    if (body === null)
+        return { status: 400, body: { success: false, code: 'INVALID_REQUEST' }, cookie: 'keep' };
+    let res;
+    try {
+        res = await deps.fetchImpl(`${deps.idp}${enrolIdpPath(input.step)}`, {
+            method: 'POST',
+            headers: headers(input.token, deps.clientKey),
+            body: JSON.stringify(body),
+            cache: 'no-store',
+        });
+    }
+    catch {
+        return { status: 502, body: { success: false, code: 'UNAVAILABLE', error: SENTENCE_UNAVAILABLE }, cookie: 'keep' };
+    }
+    const answer = await asJson(res);
+    if (res.status < 200 || res.status >= 300) {
+        const refusal = enrolRefusal(input.step, res.status, answer);
+        if (refusal === 'sign-in')
+            return { status: 401, body: { success: false, code: 'SIGN_IN_AGAIN' }, cookie: 'clear' };
+        // A mistyped code must not cost a whole sign-in (the attempt limit bounds it); every other refusal ends this enrolment.
+        return { status: refusal.status, body: { success: false, code: refusal.code, error: refusal.text }, cookie: refusal.code === 'CODE_INVALID' ? 'keep' : 'clear' };
+    }
+    if (input.step === 'enroll') {
+        const e = parseEnrol(answer);
+        if (!e)
+            return { status: 502, body: { success: false, code: 'UNAVAILABLE', error: 'We could not read the setup details. Nothing was changed. Reload the page.' }, cookie: 'clear' };
+        return { status: 200, body: { success: true, data: { secret: e.secret, otpauth_uri: e.otpauthUri, enrollment_id: e.enrollmentId } }, cookie: 'keep' };
+    }
+    // confirm: the factor is confirmed; the answer carries the FULL pair, used here ONLY to fetch the recovery codes, then dropped.
+    if (!parseConfirmed(answer))
+        return { status: 502, body: { success: false, code: 'UNAVAILABLE', error: 'We could not confirm that. Try the code again.' }, cookie: 'keep' };
+    const d = unwrap(answer);
+    const full = str(d?.access_token);
+    let codes = null;
+    if (full) {
+        try {
+            const c = await deps.fetchImpl(`${deps.idp}/api/Account/mfa/backup-codes`, { method: 'POST', headers: headers(full, deps.clientKey), body: '{}', cache: 'no-store' });
+            const list = c.ok ? parseCodes(await asJson(c)) : null;
+            codes = list ? codesForDisplay(list) : null;
+        }
+        catch {
+            codes = null;
+        }
+    }
+    return { status: 200, body: { success: true, confirmed: true, codes }, cookie: 'clear' };
+}
+// ── attempt limit: per enrolment cookie (in-memory, per instance), hard-capped ──
+const WINDOW_MS = exports.ENROL_COOKIE_MAX_AGE * 1000;
+exports.LIMIT_PER_COOKIE = 5;
+const hits = new Map();
+/**
+ * HARD CAP (portal PAY-2913, BAPert 90048): the map never holds more than this many keys; past it the OLDEST-TOUCHED key is evicted.
+ * KNOWN TRADE: a flood of forged cookies can push a real caller's counter out and reset its budget; bounded by this cap and by the IdP's own throttle.
+ * Not ported from the portal: the per-IP limit (it needs the trusted-proxy setting, PORTAL_TRUSTED_PROXY_HOPS, which a generated app does not have).
+ */
+exports.MAX_TRACKED_KEYS = 5000;
+/** True when this key may attempt now; records the attempt. Keys are never the raw cookie (the route passes a digest). */
+function attemptAllowed(key, limit, now = Date.now()) {
+    const recent = (hits.get(key) ?? []).filter((t) => now - t < WINDOW_MS);
+    const allowed = recent.length < limit;
+    if (allowed)
+        recent.push(now);
+    hits.delete(key); // re-insert at the end: Map order is last-touched order
+    hits.set(key, recent);
+    while (hits.size > exports.MAX_TRACKED_KEYS) {
+        const oldest = hits.keys().next().value;
+        if (oldest === undefined)
+            break;
+        hits.delete(oldest);
+    }
+    return allowed;
+}
+function _resetAttempts() {
+    hits.clear();
+}
+function _trackedKeys() {
+    return hits.size;
+}

package/dist/lib/idp-client-config.js

@@ -162,7 +162,7 @@ function applyEnvSecrets(config) {
             const envVar = providerSecretEnvVar(p.provider);
             const fromEnv = process.env[envVar];
             const source = fromEnv ? `env:${envVar}` : p.clientSecret ? 'idp-config' : 'none';
-            logSecretSource(`${p.provider} clientSecret`, source);
+            logSecretSource(`${(0, log_safe_1.logSafeName)(p.provider)} clientSecret`, source);
             const clientSecret = fromEnv || p.clientSecret;
             (0, never_in_response_1.markNeverInResponse)(clientSecret);
             return { ...p, clientSecret };

package/dist/lib/log-safe.d.ts

@@ -17,3 +17,9 @@ export declare function closedCodeForLog(code: unknown): string | null;
  * `NonError`; a status outside 100-599 is dropped; a code outside the closed token shape is dropped.
  */
 export declare function errForLog(err: unknown): string;
+/**
+ * A provider name (or any other IdP-supplied identifier) for a log line: lower-cased, then anything outside [a-z0-9_-] becomes '?',
+ * so a name carrying a newline cannot forge a second log line (Nextpert-Scout 102543 LOW 1; the shared helper per 104626, used at
+ * every site that logs an IdP provider name: better-auth.ts, payez-client-secret.ts, idp-client-config.ts).
+ */
+export declare function logSafeName(name: unknown): string;

package/dist/lib/log-safe.js

@@ -13,6 +13,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.closedCodeForLog = closedCodeForLog;
 exports.errForLog = errForLog;
+exports.logSafeName = logSafeName;
 /** An upstream `code` is loggable only if it is a closed token (UPPER_SNAKE). Anything else, including free text, becomes null. */
 function closedCodeForLog(code) {
     return typeof code === 'string' && /^[A-Z0-9_]{1,64}$/.test(code) ? code : null;
@@ -30,3 +31,11 @@ function errForLog(err) {
     const code = closed ? ` code=${closed}` : '';
     return `error=${name}${status}${code}`;
 }
+/**
+ * A provider name (or any other IdP-supplied identifier) for a log line: lower-cased, then anything outside [a-z0-9_-] becomes '?',
+ * so a name carrying a newline cannot forge a second log line (Nextpert-Scout 102543 LOW 1; the shared helper per 104626, used at
+ * every site that logs an IdP provider name: better-auth.ts, payez-client-secret.ts, idp-client-config.ts).
+ */
+function logSafeName(name) {
+    return String(name ?? '').toLowerCase().replace(/[^a-z0-9_-]/g, '?');
+}

package/dist/lib/payez-client-secret.js

@@ -10,6 +10,7 @@ exports.warnIfProviderSecretRedacted = warnIfProviderSecretRedacted;
  * what it sent before. The value is never logged and never leaves in a response (markNeverInResponse).
  */
 const never_in_response_1 = require("./never-in-response");
+const log_safe_1 = require("./log-safe");
 exports.CLIENT_SECRET_ENV = 'PAYEZ_CLIENT_SECRET';
 /** `{ client_secret }` when the env var is set to a non-blank value, else `{}`. Spread it into a JSON body. */
 function clientSecretBody() {
@@ -36,6 +37,6 @@ function warnIfProviderSecretRedacted(redactedHeader, providers, envVarFor) {
         if (warnedProviders.has(p.provider))
             continue;
         warnedProviders.add(p.provider);
-        console.warn(`[IDP_CONFIG] PAYEZ_PROVIDER_SECRET_MISSING_REDACTED provider=${p.provider}`);
+        console.warn(`[IDP_CONFIG] PAYEZ_PROVIDER_SECRET_MISSING_REDACTED provider=${(0, log_safe_1.logSafeName)(p.provider)}`);
     }
 }

package/dist/lib/token-pages-switch.d.ts

@@ -0,0 +1,23 @@
+/**
+ * PAY-3220 (ruled Win 105653 s1, on NextPert-MB's Mac 105619): the ONE production switch for the two token-showing
+ * test-env pages (JwtInspectPage, RefreshTokenPage) and the route the refresh page drives (POST /api/test/force-expire).
+ *
+ *   PAYEZ_TOKEN_PAGES_OFF   unset or empty            -> ON  (every page works as today; the default everywhere)
+ *                           true / 1 / yes / on       -> OFF (any letter case)
+ *                           false / 0 / no / off      -> ON  (any letter case), no warning
+ *                           anything else             -> OFF, and ONE warning per process naming the variable
+ *
+ * Why an unrecognised value is OFF (the ruling's one change to the recommendation): nobody sets this variable except to
+ * turn the pages off, on Jon's word, on a production host. A mistyped attempt to turn them off must not leave
+ * token-showing pages on in production with only a log line to say so.
+ *
+ * Read from the server's process environment on every call, never captured at module scope (a module constant would be
+ * whatever the build host had). It is not NEXT_PUBLIC_, so it never reaches a client bundle, and no request input
+ * (cookie, header, query string, body, session) is consulted: only whoever can change the host's environment can turn it.
+ *
+ * Set ONLY on a production host, ONLY on Jon's word, on the day production is real. It is never in a tracked .env file.
+ * The switch is not counted as set until the production roll's served check reads both pages and force-expire back as
+ * 404 by request (BAPert-MB 105629 s3).
+ */
+export declare const TOKEN_PAGES_OFF_ENV = "PAYEZ_TOKEN_PAGES_OFF";
+export declare function tokenPagesOff(): boolean;

package/dist/lib/token-pages-switch.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TOKEN_PAGES_OFF_ENV = void 0;
+exports.tokenPagesOff = tokenPagesOff;
+/**
+ * PAY-3220 (ruled Win 105653 s1, on NextPert-MB's Mac 105619): the ONE production switch for the two token-showing
+ * test-env pages (JwtInspectPage, RefreshTokenPage) and the route the refresh page drives (POST /api/test/force-expire).
+ *
+ *   PAYEZ_TOKEN_PAGES_OFF   unset or empty            -> ON  (every page works as today; the default everywhere)
+ *                           true / 1 / yes / on       -> OFF (any letter case)
+ *                           false / 0 / no / off      -> ON  (any letter case), no warning
+ *                           anything else             -> OFF, and ONE warning per process naming the variable
+ *
+ * Why an unrecognised value is OFF (the ruling's one change to the recommendation): nobody sets this variable except to
+ * turn the pages off, on Jon's word, on a production host. A mistyped attempt to turn them off must not leave
+ * token-showing pages on in production with only a log line to say so.
+ *
+ * Read from the server's process environment on every call, never captured at module scope (a module constant would be
+ * whatever the build host had). It is not NEXT_PUBLIC_, so it never reaches a client bundle, and no request input
+ * (cookie, header, query string, body, session) is consulted: only whoever can change the host's environment can turn it.
+ *
+ * Set ONLY on a production host, ONLY on Jon's word, on the day production is real. It is never in a tracked .env file.
+ * The switch is not counted as set until the production roll's served check reads both pages and force-expire back as
+ * 404 by request (BAPert-MB 105629 s3).
+ */
+exports.TOKEN_PAGES_OFF_ENV = 'PAYEZ_TOKEN_PAGES_OFF';
+const OFF_WORDS = new Set(['true', '1', 'yes', 'on']);
+const ON_WORDS = new Set(['false', '0', 'no', 'off']);
+let warnedUnrecognised = false;
+function tokenPagesOff() {
+    const raw = process.env[exports.TOKEN_PAGES_OFF_ENV];
+    if (raw === undefined)
+        return false;
+    const value = raw.trim().toLowerCase();
+    if (value === '')
+        return false;
+    if (OFF_WORDS.has(value))
+        return true;
+    if (ON_WORDS.has(value))
+        return false;
+    if (!warnedUnrecognised) {
+        warnedUnrecognised = true;
+        // The variable's NAME only. The value is not a secret, but nothing about it helps the reader of this line.
+        console.warn(`[test-env] ${exports.TOKEN_PAGES_OFF_ENV} is set to a value that is not recognised (true/1/yes/on or false/0/no/off); ` +
+            'the token pages are OFF: jwt-inspect, refresh-token and POST /api/test/force-expire answer 404.');
+    }
+    return true;
+}

package/dist/pages/first-enroll/page.d.ts

@@ -0,0 +1,7 @@
+/**
+ * AUTH-045 (PAY-2938): /account-auth/first-enroll in a generated app, the page a person is sent to when the IdP says they must enrol an authenticator
+ * on this app and they have NO session yet. The page SHELL is public (every /account-auth/* path is public by default); the two routes behind it read
+ * ONLY the httpOnly enrolment cookie the credential door parked, and answer 401 without it (the panel then sends the person to sign-in).
+ * Not the signed-in enrolment page (/account-auth/enroll), which needs a session.
+ */
+export default function FirstEnrollPage(): import("react/jsx-runtime").JSX.Element;

package/dist/pages/first-enroll/page.js

@@ -0,0 +1,15 @@
+"use strict";
+'use client';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = FirstEnrollPage;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const FirstEnrolPanel_1 = require("../../components/mfa/FirstEnrolPanel");
+/**
+ * AUTH-045 (PAY-2938): /account-auth/first-enroll in a generated app, the page a person is sent to when the IdP says they must enrol an authenticator
+ * on this app and they have NO session yet. The page SHELL is public (every /account-auth/* path is public by default); the two routes behind it read
+ * ONLY the httpOnly enrolment cookie the credential door parked, and answer 401 without it (the panel then sends the person to sign-in).
+ * Not the signed-in enrolment page (/account-auth/enroll), which needs a session.
+ */
+function FirstEnrollPage() {
+    return ((0, jsx_runtime_1.jsxs)("main", { style: { maxWidth: 480, margin: '48px auto', padding: '0 16px' }, children: [(0, jsx_runtime_1.jsx)("h1", { children: "Secure your account" }), (0, jsx_runtime_1.jsx)(FirstEnrolPanel_1.FirstEnrolPanel, {})] }));
+}

package/dist/pages/test-env/JwtInspectPage.d.ts

@@ -3,23 +3,25 @@
  * IN PRODUCTION. ⚠️
  *
  * Session Inspector Page. Debug page for inspecting session data from Redis:
- * shows user info, roles, 2FA status, and TOKENS. It offers
- * COPY-TO-CLIPBOARD buttons for the live SESSION TOKEN and ACCESS TOKEN, and
- * reads them from the consuming app's `/api/internal/session-data` route.
+ * shows user info, roles, 2FA status, and the DECODED CLAIMS of the IDP access
+ * token, which it reads from the consuming app's `/api/internal/session-data`
+ * route. Credentials themselves are shown as tokenLogId + length ONLY: the
+ * Copy-to-clipboard and Reveal controls this docstring used to describe were
+ * removed by PAY-1470 (BAPert 59022, 59040), and test-env-no-token-material
+ * holds the page to that. (PAY-3220: this sentence was stale until now.)
  *
  * ────────────────────────── WHY THIS WARNING EXISTS (QAPert 35000 / 248991) ──────────────────────────
- * THIS PAGE HAS NO ENV GATE OF ITS OWN. Unlike the force-expire handler
- * (default-denied behind ENABLE_TEST_ROUTES) or the idp-token route (behind
- * ENABLE_TOKEN_INSPECTOR), a mounted page is reachable exactly as far as the
- * consuming app's own middleware allows. MOUNTING IT IS THE GATE. There is no
- * second line of defence behind it.
+ * Like the force-expire handler (no flag since PAY-3216) and unlike the
+ * idp-token route (behind ENABLE_TOKEN_INSPECTOR), a mounted page is reachable
+ * exactly as far as the consuming app's own middleware allows. MOUNTING IT IS
+ * THE GATE. The one switch on it is PAYEZ_TOKEN_PAGES_OFF (PAY-3220), unset by
+ * default and set only on a production host on Jon's word.
  *
- * AND THE CREDENTIAL IT HANDS OVER IS THE PRECONDITION FOR A REAL ATTACK ON
- * THIS SAME PACKAGE. The 246007 finding reduces to "a caller who KNOWS A
- * SESSION TOKEN can act on a session it does not own". The purpose of this
- * page is to put a live session token on the clipboard of whoever loads it. A
- * screen-share, a shoulder-surfed screenshot or a support call is enough.
- * Treat the rendered value as a live credential, because that is what it is.
+ * WHAT IT STILL HANDS OVER IS SENSITIVE. The decoded claims say who the
+ * signed-in person is, which roles they hold and how they authenticated, and
+ * the 246007 finding reduces to "a caller who KNOWS A SESSION TOKEN can act on
+ * a session it does not own": a page that once showed that token is the reason
+ * this one is treated as a production hazard.
  *
  * NOTE FOR MAINTAINERS: this warning must stay on THIS docstring, the one
  * attached to the exported declaration. An identical block placed higher in

package/dist/pages/test-env/JwtInspectPage.js

@@ -39,23 +39,25 @@ function decodeJwtPayload(token) {
  * IN PRODUCTION. ⚠️
  *
  * Session Inspector Page. Debug page for inspecting session data from Redis:
- * shows user info, roles, 2FA status, and TOKENS. It offers
- * COPY-TO-CLIPBOARD buttons for the live SESSION TOKEN and ACCESS TOKEN, and
- * reads them from the consuming app's `/api/internal/session-data` route.
+ * shows user info, roles, 2FA status, and the DECODED CLAIMS of the IDP access
+ * token, which it reads from the consuming app's `/api/internal/session-data`
+ * route. Credentials themselves are shown as tokenLogId + length ONLY: the
+ * Copy-to-clipboard and Reveal controls this docstring used to describe were
+ * removed by PAY-1470 (BAPert 59022, 59040), and test-env-no-token-material
+ * holds the page to that. (PAY-3220: this sentence was stale until now.)
  *
  * ────────────────────────── WHY THIS WARNING EXISTS (QAPert 35000 / 248991) ──────────────────────────
- * THIS PAGE HAS NO ENV GATE OF ITS OWN. Unlike the force-expire handler
- * (default-denied behind ENABLE_TEST_ROUTES) or the idp-token route (behind
- * ENABLE_TOKEN_INSPECTOR), a mounted page is reachable exactly as far as the
- * consuming app's own middleware allows. MOUNTING IT IS THE GATE. There is no
- * second line of defence behind it.
+ * Like the force-expire handler (no flag since PAY-3216) and unlike the
+ * idp-token route (behind ENABLE_TOKEN_INSPECTOR), a mounted page is reachable
+ * exactly as far as the consuming app's own middleware allows. MOUNTING IT IS
+ * THE GATE. The one switch on it is PAYEZ_TOKEN_PAGES_OFF (PAY-3220), unset by
+ * default and set only on a production host on Jon's word.
  *
- * AND THE CREDENTIAL IT HANDS OVER IS THE PRECONDITION FOR A REAL ATTACK ON
- * THIS SAME PACKAGE. The 246007 finding reduces to "a caller who KNOWS A
- * SESSION TOKEN can act on a session it does not own". The purpose of this
- * page is to put a live session token on the clipboard of whoever loads it. A
- * screen-share, a shoulder-surfed screenshot or a support call is enough.
- * Treat the rendered value as a live credential, because that is what it is.
+ * WHAT IT STILL HANDS OVER IS SENSITIVE. The decoded claims say who the
+ * signed-in person is, which roles they hold and how they authenticated, and
+ * the 246007 finding reduces to "a caller who KNOWS A SESSION TOKEN can act on
+ * a session it does not own": a page that once showed that token is the reason
+ * this one is treated as a production hazard.
  *
  * NOTE FOR MAINTAINERS: this warning must stay on THIS docstring, the one
  * attached to the exported declaration. An identical block placed higher in

package/dist/pages/test-env/RefreshTokenPage.d.ts

@@ -7,25 +7,22 @@
  * `/api/test/force-expire`. That endpoint MUTATES SESSION STATE.
  *
  * ────────────────────────── WHY THIS WARNING EXISTS (QAPert 35000) ──────────────────────────
- * The force-expire HANDLER was fixed (244877: default-deny behind
- * ENABLE_TEST_ROUTES) and its docstring corrected to say so — but that fix
- * covered the ROUTE AND NOT THE PAGE THAT DRIVES IT. This page is a separate
+ * The force-expire HANDLER was fixed (244877) and its docstring corrected to
+ * say so — but that fix covered the ROUTE AND NOT THE PAGE THAT DRIVES IT. This page is a separate
  * public export carrying its own mount instructions, so a consumer can follow
  * these lines and never once read the handler's warning.
  *
- * THIS PAGE HAS NO ENV GATE OF ITS OWN. Mounting it is the gate. The two are
- * independent: mounting this page while ENABLE_TEST_ROUTES is unset gives you
- * a button that 404s — confusing, but safe. The unsafe configuration is
- * setting that flag anywhere this page is also reachable.
+ * THIS PAGE HAS NO ENV GATE OF ITS OWN, and since PAY-3216 neither has the
+ * handler it drives: mounting is the gate. Wherever this page and the
+ * force-expire route are both mounted, the button works.
  *
  * ────────────────────────── IF YOU MOUNT IT, MOUNT IT LIKE THIS ──────────────────────────
  * ```typescript
  * // app/test-env/refresh-token/page.tsx   — TEST/DEV ENVIRONMENTS ONLY
  * export { RefreshTokenPage as default } from '@payez/next-mvp/pages/test-env';
  * ```
- * Requires ENABLE_TEST_ROUTES=true IN THAT ENVIRONMENT ONLY for the button to
- * do anything. Never set it in production. If you do not need to exercise the
- * refresh flow, DO NOT MOUNT THIS AT ALL.
+ * The button needs /api/test/force-expire mounted too; there is no flag. If
+ * you do not need to exercise the refresh flow, DO NOT MOUNT THIS AT ALL.
  */
 export declare function RefreshTokenPage(): import("react/jsx-runtime").JSX.Element;
 export default RefreshTokenPage;

package/dist/pages/test-env/RefreshTokenPage.js

@@ -17,25 +17,22 @@ const redact_credentials_1 = require("./redact-credentials");
  * `/api/test/force-expire`. That endpoint MUTATES SESSION STATE.
  *
  * ────────────────────────── WHY THIS WARNING EXISTS (QAPert 35000) ──────────────────────────
- * The force-expire HANDLER was fixed (244877: default-deny behind
- * ENABLE_TEST_ROUTES) and its docstring corrected to say so — but that fix
- * covered the ROUTE AND NOT THE PAGE THAT DRIVES IT. This page is a separate
+ * The force-expire HANDLER was fixed (244877) and its docstring corrected to
+ * say so — but that fix covered the ROUTE AND NOT THE PAGE THAT DRIVES IT. This page is a separate
  * public export carrying its own mount instructions, so a consumer can follow
  * these lines and never once read the handler's warning.
  *
- * THIS PAGE HAS NO ENV GATE OF ITS OWN. Mounting it is the gate. The two are
- * independent: mounting this page while ENABLE_TEST_ROUTES is unset gives you
- * a button that 404s — confusing, but safe. The unsafe configuration is
- * setting that flag anywhere this page is also reachable.
+ * THIS PAGE HAS NO ENV GATE OF ITS OWN, and since PAY-3216 neither has the
+ * handler it drives: mounting is the gate. Wherever this page and the
+ * force-expire route are both mounted, the button works.
  *
  * ────────────────────────── IF YOU MOUNT IT, MOUNT IT LIKE THIS ──────────────────────────
  * ```typescript
  * // app/test-env/refresh-token/page.tsx   — TEST/DEV ENVIRONMENTS ONLY
  * export { RefreshTokenPage as default } from '@payez/next-mvp/pages/test-env';
  * ```
- * Requires ENABLE_TEST_ROUTES=true IN THAT ENVIRONMENT ONLY for the button to
- * do anything. Never set it in production. If you do not need to exercise the
- * refresh flow, DO NOT MOUNT THIS AT ALL.
+ * The button needs /api/test/force-expire mounted too; there is no flag. If
+ * you do not need to exercise the refresh flow, DO NOT MOUNT THIS AT ALL.
  */
 function RefreshTokenPage() {
     const { data: session } = better_auth_client_1.authClient.useSession();